The update button in the certificates window (T5903) does only initiate a check on the configured keyserver.
It should check on wkd if the key origin is wkd.
Or both places should be queried for all keys.